Skip to content

Commit 36ba0d7

Browse files
SAERXCITSAERXCIT
committed
Initial commit
0 parents  commit 36ba0d7

5 files changed

+343
-0
lines changed

‎EnableParentPriv.sln

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.5.33627.172
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "EnableParentPriv", "EnableParentPriv.vcxproj", "{7FECF06F-6FAA-46C1-93BB-00831F6BE5D9}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|x64 = Debug|x64
11+
Debug|x86 = Debug|x86
12+
Release|x64 = Release|x64
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{7FECF06F-6FAA-46C1-93BB-00831F6BE5D9}.Debug|x64.ActiveCfg = Debug|x64
17+
{7FECF06F-6FAA-46C1-93BB-00831F6BE5D9}.Debug|x64.Build.0 = Debug|x64
18+
{7FECF06F-6FAA-46C1-93BB-00831F6BE5D9}.Debug|x86.ActiveCfg = Debug|Win32
19+
{7FECF06F-6FAA-46C1-93BB-00831F6BE5D9}.Debug|x86.Build.0 = Debug|Win32
20+
{7FECF06F-6FAA-46C1-93BB-00831F6BE5D9}.Release|x64.ActiveCfg = Release|x64
21+
{7FECF06F-6FAA-46C1-93BB-00831F6BE5D9}.Release|x64.Build.0 = Release|x64
22+
{7FECF06F-6FAA-46C1-93BB-00831F6BE5D9}.Release|x86.ActiveCfg = Release|Win32
23+
{7FECF06F-6FAA-46C1-93BB-00831F6BE5D9}.Release|x86.Build.0 = Release|Win32
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {057EA694-C45A-44E6-8807-42762EEC57DE}
30+
EndGlobalSection
31+
EndGlobal

‎EnableParentPriv.vcxproj

+139
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>16.0</VCProjectVersion>
23+
<Keyword>Win32Proj</Keyword>
24+
<ProjectGuid>{7fecf06f-6faa-46c1-93bb-00831f6be5d9}</ProjectGuid>
25+
<RootNamespace>EnableParentPriv</RootNamespace>
26+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
27+
</PropertyGroup>
28+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
29+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
30+
<ConfigurationType>Application</ConfigurationType>
31+
<UseDebugLibraries>true</UseDebugLibraries>
32+
<PlatformToolset>v143</PlatformToolset>
33+
<CharacterSet>Unicode</CharacterSet>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
36+
<ConfigurationType>Application</ConfigurationType>
37+
<UseDebugLibraries>false</UseDebugLibraries>
38+
<PlatformToolset>v143</PlatformToolset>
39+
<WholeProgramOptimization>true</WholeProgramOptimization>
40+
<CharacterSet>Unicode</CharacterSet>
41+
</PropertyGroup>
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
43+
<ConfigurationType>Application</ConfigurationType>
44+
<UseDebugLibraries>true</UseDebugLibraries>
45+
<PlatformToolset>v143</PlatformToolset>
46+
<CharacterSet>Unicode</CharacterSet>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
49+
<ConfigurationType>Application</ConfigurationType>
50+
<UseDebugLibraries>false</UseDebugLibraries>
51+
<PlatformToolset>v143</PlatformToolset>
52+
<WholeProgramOptimization>true</WholeProgramOptimization>
53+
<CharacterSet>Unicode</CharacterSet>
54+
</PropertyGroup>
55+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
56+
<ImportGroup Label="ExtensionSettings">
57+
</ImportGroup>
58+
<ImportGroup Label="Shared">
59+
</ImportGroup>
60+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
61+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
62+
</ImportGroup>
63+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
64+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
65+
</ImportGroup>
66+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
67+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
68+
</ImportGroup>
69+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
70+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
71+
</ImportGroup>
72+
<PropertyGroup Label="UserMacros" />
73+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
74+
<ClCompile>
75+
<WarningLevel>Level3</WarningLevel>
76+
<SDLCheck>true</SDLCheck>
77+
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
78+
<ConformanceMode>true</ConformanceMode>
79+
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
80+
</ClCompile>
81+
<Link>
82+
<SubSystem>Console</SubSystem>
83+
<GenerateDebugInformation>true</GenerateDebugInformation>
84+
</Link>
85+
</ItemDefinitionGroup>
86+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
87+
<ClCompile>
88+
<WarningLevel>Level3</WarningLevel>
89+
<FunctionLevelLinking>true</FunctionLevelLinking>
90+
<IntrinsicFunctions>true</IntrinsicFunctions>
91+
<SDLCheck>true</SDLCheck>
92+
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
93+
<ConformanceMode>true</ConformanceMode>
94+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
95+
</ClCompile>
96+
<Link>
97+
<SubSystem>Console</SubSystem>
98+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
99+
<OptimizeReferences>true</OptimizeReferences>
100+
<GenerateDebugInformation>true</GenerateDebugInformation>
101+
</Link>
102+
</ItemDefinitionGroup>
103+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
104+
<ClCompile>
105+
<WarningLevel>Level3</WarningLevel>
106+
<SDLCheck>true</SDLCheck>
107+
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
108+
<ConformanceMode>true</ConformanceMode>
109+
<RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
110+
</ClCompile>
111+
<Link>
112+
<SubSystem>Console</SubSystem>
113+
<GenerateDebugInformation>true</GenerateDebugInformation>
114+
</Link>
115+
</ItemDefinitionGroup>
116+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
117+
<ClCompile>
118+
<WarningLevel>Level3</WarningLevel>
119+
<FunctionLevelLinking>true</FunctionLevelLinking>
120+
<IntrinsicFunctions>true</IntrinsicFunctions>
121+
<SDLCheck>true</SDLCheck>
122+
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
123+
<ConformanceMode>true</ConformanceMode>
124+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
125+
</ClCompile>
126+
<Link>
127+
<SubSystem>Console</SubSystem>
128+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
129+
<OptimizeReferences>true</OptimizeReferences>
130+
<GenerateDebugInformation>true</GenerateDebugInformation>
131+
</Link>
132+
</ItemDefinitionGroup>
133+
<ItemGroup>
134+
<ClCompile Include="main.c" />
135+
</ItemGroup>
136+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
137+
<ImportGroup Label="ExtensionTargets">
138+
</ImportGroup>
139+
</Project>

‎EnableParentPriv.vcxproj.filters

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="Source Files">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="Header Files">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
11+
</Filter>
12+
<Filter Include="Resource Files">
13+
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14+
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15+
</Filter>
16+
</ItemGroup>
17+
<ItemGroup>
18+
<ClCompile Include="main.c">
19+
<Filter>Source Files</Filter>
20+
</ClCompile>
21+
</ItemGroup>
22+
</Project>

‎EnableParentPriv.vcxproj.user

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<PropertyGroup />
4+
</Project>

‎main.c

+147
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
#include <Windows.h>h
2+
#include <stdio.h>
3+
#include <shlwapi.h>
4+
#include <tlhelp32.h>
5+
6+
#pragma comment(lib, "shlwapi.lib")
7+
8+
int main(int argc, char** argv) {
9+
10+
if (argc < 2) {
11+
12+
printf("%s enables the requested privilege in its parent process: the shell calling it\n", argv[0]);
13+
printf("Usage: %s <privilege_number>\n\nPrivilege list: (source https://github.com/gentilkiwi/mimikatz/blob/master/mimikatz/modules/kuhl_m_privilege.h)\n", argv[0]);
14+
printf("SE_CREATE_TOKEN 2\n\
15+
SE_ASSIGNPRIMARYTOKEN 3\n\
16+
SE_LOCK_MEMORY 4\n\
17+
SE_INCREASE_QUOTA 5\n\
18+
SE_UNSOLICITED_INPUT 6\n\
19+
SE_TCB 7\n\
20+
SE_SECURITY 8\n\
21+
SE_TAKE_OWNERSHIP 9\n\
22+
SE_LOAD_DRIVER 10\n\
23+
SE_SYSTEM_PROFILE 11\n\
24+
SE_SYSTEMTIME 12\n\
25+
SE_PROF_SINGLE_PROCESS 13\n\
26+
SE_INC_BASE_PRIORITY 14\n\
27+
SE_CREATE_PAGEFILE 15\n\
28+
SE_CREATE_PERMANENT 16\n\
29+
SE_BACKUP 17\n\
30+
SE_RESTORE 18\n\
31+
SE_SHUTDOWN 19\n\
32+
SE_DEBUG 20\n\
33+
SE_AUDIT 21\n\
34+
SE_SYSTEM_ENVIRONMENT 22\n\
35+
SE_CHANGE_NOTIFY 23\n\
36+
SE_REMOTE_SHUTDOWN 24\n\
37+
SE_UNDOCK 25\n\
38+
SE_SYNC_AGENT 26\n\
39+
SE_ENABLE_DELEGATION 27\n\
40+
SE_MANAGE_VOLUME 28\n\
41+
SE_IMPERSONATE 29\n\
42+
SE_CREATE_GLOBAL 30\n\
43+
SE_TRUSTED_CREDMAN_ACCESS 31\n\
44+
SE_RELABEL 32\n\
45+
SE_INC_WORKING_SET 33\n\
46+
SE_TIME_ZONE 34\n\
47+
SE_CREATE_SYMBOLIC_LINK 35\n");
48+
return -1;
49+
50+
}
51+
52+
int iPrivId = 0;
53+
int iRet = 0;
54+
HANDLE hToken = NULL;
55+
HANDLE hParentProcess = NULL;
56+
TOKEN_PRIVILEGES sctTokPriv = { 0 };
57+
HANDLE hSnapshot = NULL;
58+
PROCESSENTRY32W sctPe32 = { 0 };
59+
sctPe32.dwSize = sizeof(PROCESSENTRY32W);
60+
DWORD dwCurrentPid = GetCurrentProcessId();
61+
DWORD dwParentPid = 0;
62+
63+
64+
if (!StrToIntExA(argv[1], STIF_DEFAULT, &iPrivId) || iPrivId < 2 || iPrivId > 35) {
65+
66+
printf("[-] Invalid privilege id: %s\n", argv[1]);
67+
iRet = -1; goto _EndOfFunc;
68+
69+
}
70+
71+
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
72+
if (hSnapshot == INVALID_HANDLE_VALUE) {
73+
74+
printf("[-] CreateToolhelp32Snapshot Failed With Error : %d \n", GetLastError());
75+
iRet = -1; goto _EndOfFunc;
76+
}
77+
78+
if (Process32First(hSnapshot, &sctPe32)) {
79+
80+
do {
81+
if (sctPe32.th32ProcessID == dwCurrentPid) {
82+
dwParentPid = sctPe32.th32ParentProcessID;
83+
break;
84+
}
85+
} while (Process32Next(hSnapshot, &sctPe32));
86+
87+
}
88+
else {
89+
90+
printf("[!] Process32First Failed With Error : %d \n", GetLastError());
91+
iRet = -1; goto _EndOfFunc;
92+
93+
}
94+
95+
if (dwParentPid == 0) {
96+
97+
printf("[-] Could not find parent PID\n");
98+
iRet = -1; goto _EndOfFunc;
99+
100+
}
101+
102+
hParentProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, dwParentPid);
103+
if (hParentProcess == NULL) {
104+
105+
printf("[-] Error opening parent process with PROCESS_QUERY_LIMITED_INFORMATION: %d\n", GetLastError());
106+
iRet = -1; goto _EndOfFunc;
107+
108+
}
109+
110+
if (!OpenProcessToken(hParentProcess, TOKEN_ADJUST_PRIVILEGES, &hToken)) {
111+
112+
printf("[-] Error opening parent process token with TOKEN_ADJUST_PRIVILEGES: %d\n", GetLastError());
113+
iRet = -1; goto _EndOfFunc;
114+
115+
}
116+
117+
sctTokPriv.PrivilegeCount = 1;
118+
sctTokPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
119+
sctTokPriv.Privileges[0].Luid.LowPart = iPrivId;
120+
sctTokPriv.Privileges[0].Luid.HighPart = 0;
121+
122+
if (!AdjustTokenPrivileges(hToken, FALSE, &sctTokPriv, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) {
123+
124+
printf("[-] Error adjusting token privilege: %d\n", GetLastError());
125+
iRet = -1; goto _EndOfFunc;
126+
127+
}
128+
else if (GetLastError() == ERROR_NOT_ALL_ASSIGNED) {
129+
130+
printf("[-] Current token does not have the requested privilege\n");
131+
iRet = -1; goto _EndOfFunc;
132+
133+
}
134+
135+
printf("[+] Success enabling requested privilege!\n");
136+
137+
_EndOfFunc:
138+
if(hParentProcess && hParentProcess != INVALID_HANDLE_VALUE)
139+
CloseHandle(hParentProcess);
140+
if (hSnapshot && hSnapshot != INVALID_HANDLE_VALUE)
141+
CloseHandle(hSnapshot);
142+
if (hToken && hToken != INVALID_HANDLE_VALUE)
143+
CloseHandle(hToken);
144+
145+
return iRet;
146+
147+
}

0 commit comments

Comments
 (0)